The dartiss draft-list WordPress plugin versions 2.6.3 and earlier are vulnerable to stored XSS via the `[drafts]` shortcode and Draft List widget when a custom template places the {{draft}} placeholder inside an HTML attribute. The plugin inserts the raw draft post_title into the placeholder without proper neutralization when the viewer lacks edit permissions. Although the template is sanitized before replacement, a contributor can store a specially crafted title containing quotes to break out of the attribute context and inject JavaScript, leading to script execution for public page visitors. The issue is resolved in version 2.6.4.

An attacker with contributor-level permissions can inject malicious JavaScript into draft post titles that execute in the browsers of users viewing the public page containing the draft list. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability requires user interaction (UI:R) and privileges to create or edit drafts (PR:L). The CVSS score is 6.5 (medium severity).

Upgrade the dartiss draft-list plugin to version 2.6.4 or later, where this vulnerability is fixed. No other mitigations are specified or required once patched.